claims-get-percentage-value@35.4.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js, unless an opt-out environment variable is set.

Remote code execution as the importing process user.

Import-time download-and-execute bootstrapper with DNS fallback.

At import time, index.js suppresses errors while requiring _platform.js. That module retrieves a platform-specific binary from hard-coded worker hosts, or reconstructs one through DNS TXT records from fallback domains. It stores the bytes in a temporary executable file and launches it detached through cmd.exe or /bin/sh, without signature or integrity verification. The separately bundled telemetry module contains the same configurable downloader/executor pattern.

This is concrete import-time remote payload execution unrelated to the declared claims API. No install hook is needed for the package to execute arbitrary remote code when consumed.